How to use rex to extract field before two symbols

[adamsobczykhsbc]

I have raw data like:

Error=REQUEST ERROR | request is not valid.|","time":"1707622073040"

and I want to extract "REQUEST ERROR | request is not valid." to a new field, so I try to use rex to match until |" with below query but it still only returns "REQUEST ERROR"

|rex field=_raw "Error\=(?<ErrDesc>[^|\"]+)" 

[gcusello]

Hi @adamsobczykhsbc,

please try this:

| rex "Error\=(?<ErrDesc>[^\|]+\|[^\|]+)"

that you can test at https://regex101.com/r/mIlDeU/1

Ciao.

Giuseppe

[adamsobczykhsbc]

Hi @gcusello , it works for that specific case, however my extracted field ErrDesc will not always have pipe "|" inside, basically I want to match anything until |" , no matter if pipe is in the field or not

[gcusello]

Hi @adamsobczykhsbc,

could you share some sample of your logs (both cases)?.

Ciao.

Giuseppe

[adamsobczykhsbc · Accepted solution]

I just figured it out with guidance from https://stackoverflow.com/questions/7124778/how-can-i-match-anything-up-until-this-sequence-of-chara... 

correct rex will be

|rex field=_raw "Error\=(?<ErrDesc>.+?(?=\|\"))"

thanks for help!

[gcusello]

Hi @adamsobczykhsbc ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉